Privacy Policy

This Privacy Policy applies to personal data processed through Emerald Ekam in connection with:

1. account creation and authentication;
2. loans and credit products;
3. payment and bill-payment services;
4. insurance products;
5. digital gold and similar products;
6. gift cards, vouchers, rewards and benefit products;
7. financial-product discovery, comparison and application routing;
8. customer support and grievance redressal;
9. fraud prevention and security;
10. marketing and promotional communications; and
11. other services introduced on the Platform from time to time.

This Privacy Policy does not govern a third-party service provider’s independent processing of your personal data. The privacy policy and product terms of the relevant third party will apply to such processing.

Depending on the relevant service, Eclat may process personal data as:

1. the entity determining why and how personal data is processed;
2. a technology platform or facilitator;
3. a distributor, sourcing partner or marketing partner;
4. a lending service provider acting for a regulated lender;
5. a service provider acting on the instructions of another entity; or
6. a seller or distributor of a particular product.

For products issued or provided by third parties, such as lenders, insurers, payment-service providers, gold providers, billers and voucher issuers, those entities may independently determine how your personal data is processed.

The personal data collected will depend on the service you use.

3.1Identity and Profile Information

We may collect:

1. full name;
2. date of birth;
3. gender, where relevant and lawfully required;
4. photograph;
5. residential and correspondence address;
6. nationality and residency information;
7. PAN and other identification details;
8. masked Aadhaar details or Aadhaar-derived information, where lawfully used;
9. KYC status and verification results; and
10. electronic signatures, declarations and consents.

3.2Contact Information

We may collect:

1. mobile number;
2. email address;
3. postal address;
4. communication preferences; and
5. records of OTP verification.

3.3Financial Information

Depending on the product, we may collect:

1. bank-account details;
2. account-holder name;
3. IFSC code;
4. UPI ID;
5. payment and transaction information;
6. income and financial-obligation details;
7. loan and repayment information;
8. requested loan amount and purpose;
9. credit eligibility and assessment information;
10. insurance premium and policy information;
11. digital-gold purchase and sale information; and
12. voucher, gift-card and bill-payment transaction details.

We do not ordinarily store your complete card number, CVV, UPI PIN, internet-banking password or other confidential payment authentication credentials. Such information is generally processed by authorised payment-service providers.

3.4Employment, Income and Business Information

Where relevant to a product, we may collect:

1. occupation and employment type;
2. employer or business name;
3. designation and work experience;
4. monthly or annual income;
5. salary slips;
6. bank statements;
7. income-tax returns;
8. business vintage and turnover;
9. GST registration and returns;
10. corporate or organisational information; and
11. other supporting financial documents.

3.5Credit-Related Information

Where applicable and after obtaining the required authorisation, we may collect or receive:

1. credit score;
2. credit report;
3. existing loans and credit facilities;
4. repayment history;
5. enquiries and defaults;
6. credit exposure;
7. eligibility indicators; and
8. lender decisions and application status.

3.6KYC and Verification Information

We may collect or receive:

1. PAN verification results;
2. identity and address verification results;
3. bank-account verification results;
4. video or digital KYC information;
5. business and GST verification results;
6. fraud and identity-risk indicators;
7. sanctions or watchlist screening results; and
8. information supplied by authorised verification providers.

Where Aadhaar is used, it will be used only through a legally permitted method and subject to the notices and consents required for that verification.

3.7Device and Technical Information

When you use the Platform, we may automatically collect:

1. IP address;
2. device type and model;
3. operating system;
4. browser type;
5. device identifiers;
6. application version;
7. language and time-zone settings;
8. login timestamps;
9. session information;
10. crash reports;
11. security logs; and
12. diagnostic and performance data.

3.8Usage Information

We may collect information about:

1. pages and screens viewed;
2. products searched, viewed or selected;
3. application journeys started or completed;
4. buttons and links clicked;
5. time spent on the Platform;
6. referring pages or campaigns;
7. communication interactions; and
8. preferences inferred from Platform activity.

3.9Communications and Support Information

We may collect:

1. customer-support tickets;
2. complaints and grievances;
3. email and chat correspondence;
4. call recordings, where permitted and notified;
5. documents submitted for dispute resolution;
6. feedback and survey responses; and
7. records of communications sent to or received from you.

3.10Information From Other Sources

We may receive information from:

1. banks and non-banking financial companies;
2. insurers and insurance intermediaries;
3. payment gateways and payment-service providers;
4. credit-information companies;
5. KYC and identity-verification providers;
6. government or authorised databases;
7. account aggregators, where separately authorised by you;
8. bill-payment networks and billers;
9. digital-gold providers;
10. gift-card and voucher issuers;
11. merchants and service providers;
12. business partners and referral partners; and
13. fraud-prevention and cybersecurity providers.

We may collect personal data:

1. directly from you;
2. when you create or update an account;
3. when you complete an OTP verification;
4. when you apply for or use a product;
5. when you upload documents;
6. when you make a payment or transaction;
7. when you contact customer support;
8. through cookies and similar technologies;
9. from service providers involved in your transaction;
10. from regulated entities processing your application;
11. from authorised verification sources; and
12. from other sources where permitted by law or authorised by you.

We may process personal data for the following purposes.

5.1Account Creation and Management

To:

1. register and authenticate your account;
2. verify your mobile number and email address;
3. prevent duplicate or fraudulent registrations;
4. maintain and update your profile;
5. manage your login credentials; and
6. provide access to Platform features.

5.2Providing Products and Services

To:

1. display relevant products;
2. assess preliminary eligibility;
3. route applications to relevant service providers;
4. facilitate application completion;
5. obtain and display offers;
6. facilitate transactions and payments;
7. provide status updates;
8. support product fulfilment;
9. maintain transaction history; and
10. provide post-transaction support.

5.3Identity Verification and KYC

To:

1. verify your identity;
2. validate documents;
3. complete KYC or due-diligence checks;
4. verify bank or business details;
5. prevent identity theft and impersonation;
6. conduct fraud, sanctions and risk screening; and
7. comply with applicable legal or regulatory requirements.

5.4Loan and Credit Facilitation

Where you apply for a loan or credit product, we may use your personal data to:

1. transmit your application to one or more lenders;
2. assess indicative eligibility;
3. obtain lender offers or decisions;
4. facilitate underwriting and verification;
5. provide application-status updates;
6. facilitate execution of loan documents;
7. assist with disbursement and repayment-related communication; and
8. support complaints and servicing requests.

The relevant lender will independently determine whether to approve or reject your application and the terms on which credit may be offered.

5.5Payment Processing

To:

1. initiate and confirm payments;
2. reconcile transactions;
3. process refunds or reversals;
4. detect duplicate or suspicious payments;
5. respond to payment disputes;
6. maintain payment records; and
7. comply with payment-system requirements.

5.6Customer Support and Grievance Redressal

To:

1. respond to enquiries;
2. resolve complaints;
3. investigate failed or disputed transactions;
4. coordinate with service providers;
5. maintain support records; and
6. improve service quality.

5.7Security and Fraud Prevention

To:

1. secure accounts and transactions;
2. detect unauthorised access;
3. monitor suspicious activity;
4. prevent fraud, impersonation and misuse;
5. investigate security incidents;
6. enforce our Terms of Use; and
7. protect our users, partners and systems.

5.8Platform Operations and Improvement

To:

1. operate and maintain the Platform;
2. diagnose errors and outages;
3. improve user journeys;
4. conduct analytics and performance testing;
5. develop new features;
6. personalise Platform content;
7. monitor service-provider performance; and
8. generate aggregated business and operational reports.

5.9Communications

To send:

1. OTPs;
2. account and security alerts;
3. application-status updates;
4. transaction confirmations;
5. payment and repayment reminders;
6. policy or service notices;
7. customer-support responses; and
8. regulatory or legally required communications.

5.10Marketing and Promotions

Subject to applicable law and your preferences, we may use your information to:

1. inform you about products and services;
2. send personalised offers;
3. conduct promotional campaigns;
4. measure campaign effectiveness;
5. recommend products based on your Platform activity; and
6. conduct surveys or engagement programmes.

You may opt out of promotional communications using the unsubscribe facility or by contacting us. You may continue to receive essential transactional, security and service communications.

5.11Legal and Regulatory Compliance

To:

1. comply with applicable laws and regulatory directions;
2. respond to lawful requests from authorities;
3. maintain statutory and regulatory records;
4. prevent money laundering, fraud and unlawful activity;
5. establish, exercise or defend legal claims;
6. conduct audits and investigations; and
7. enforce contractual rights.

We process personal data where:

1. you have provided consent for a specified purpose;
2. processing is necessary to provide a service requested by you;
3. processing is necessary to perform or manage a contract;
4. processing is required to comply with law or a regulatory obligation;
5. processing is permitted for a legitimate use recognised under applicable law;
6. processing is necessary to prevent fraud or secure the Platform; or
7. another lawful basis is available.

Where we rely on consent, you may withdraw that consent using the method specified in the relevant notice or by contacting us.

Withdrawal of consent will not affect processing already lawfully undertaken. It may prevent us from continuing to provide a product or service that requires the relevant information.

Where consent is required, we will endeavour to ensure that the request:

1. is clear and understandable;
2. identifies the relevant purpose;
3. explains the categories of information involved;
4. identifies relevant recipients or classes of recipients, where appropriate;
5. allows an affirmative action by you; and
6. provides a mechanism for withdrawal.

Separate consent may be requested for activities such as:

1. credit-bureau enquiries;
2. Aadhaar-based verification;
3. access to bank or financial information;
4. sharing an application with multiple providers;
5. marketing communications;
6. device permissions; and
7. processing required for a specific product.

Consent records may include the date, time, purpose, notice version, acceptance method and technical details associated with your acceptance.

Where you apply for a loan or credit product, we or the relevant lender may request your permission to obtain your credit information from one or more credit-information companies.

Credit information will be accessed only for the purpose disclosed to you and subject to the authorisation obtained from you.

Your credit report or score may influence:

1. eligibility;
2. available lenders;
3. approved amount;
4. pricing;
5. tenure; and
6. other credit terms.

Emerald Ekam does not control the contents of a credit report prepared by a credit-information company. Disputes concerning the report may need to be raised directly with the relevant credit-information company or reporting institution.

Where Aadhaar-based verification is offered:

1. its purpose will be disclosed to you;
2. your consent will be obtained where required;
3. the verification will be conducted through a legally permitted mechanism;
4. alternative identification methods may be provided where required by law;
5. Aadhaar authentication data will not be used for an unrelated purpose; and
6. authentication credentials such as Aadhaar OTPs or biometric information will not be permanently stored by Eclat.

We may retain verification status, transaction reference, consent record, masked identification information and audit information where lawfully permitted or required.

Our mobile application may request access to device features such as:

1. camera, for document capture or verification;
2. photo or file storage, for document upload;
3. location, where required for verification, fraud prevention or a specific service;
4. notifications, for transaction and account alerts; and
5. device information, for security and fraud prevention.

Permissions will be requested through your device or application interface. You can manage permissions through your device settings.

Disabling a permission may prevent a feature that depends on that permission from functioning.

Unless specifically disclosed and lawfully permitted, the Platform will not access unrelated personal files, contact lists, call logs, messages or media stored on your device.

We may use cookies, pixels, software-development kits and similar technologies to:

1. maintain user sessions;
2. remember preferences;
3. improve security;
4. understand Platform usage;
5. diagnose technical issues;
6. measure campaign performance; and
7. personalise content.

Cookies may be:

1. strictly necessary;
2. functional;
3. analytical; or
4. advertising or marketing-related.

You may manage cookies through your browser or device settings. Disabling necessary cookies may affect Platform functionality.

We may use rules, models or automated tools to:

1. organise and route applications;
2. identify potentially suitable products;
3. detect incomplete information;
4. identify suspicious activity;
5. personalise recommendations; and
6. improve Platform operations.

Any eligibility or product recommendation displayed by the Platform may be indicative. Final lending, insurance, investment or product decisions are made by the relevant service provider under its own criteria.

Where required by law, we will provide appropriate information or safeguards relating to material decisions made solely through automated processing.

We may share personal data only where reasonably required for the purposes described in this Privacy Policy.

13.1Financial and Product Providers

We may share information with:

1. banks;
2. non-banking financial companies;
3. insurers;
4. insurance intermediaries;
5. payment-service providers;
6. digital-gold providers;
7. billers and bill-payment networks;
8. gift-card or voucher issuers;
9. merchants; and
10. other product or service providers selected by you or relevant to your application.

13.2Technology and Operational Service Providers

We may share information with providers of:

1. cloud hosting and data storage;
2. identity and KYC verification;
3. credit-bureau and risk services;
4. communication services;
5. payment processing;
6. cybersecurity and fraud prevention;
7. document management and electronic signatures;
8. analytics and performance monitoring;
9. customer-support systems;
10. audit and compliance services; and
11. other technology or operational support.

These providers are permitted to process personal data only for authorised purposes and subject to appropriate contractual, confidentiality and security requirements.

13.3Professional Advisers

We may share information with:

1. lawyers;
2. auditors;
3. accountants;
4. consultants;
5. insurers; and
6. other professional advisers,

where reasonably necessary for professional, legal, audit, risk or compliance purposes.

13.4Government and Regulatory Authorities

We may disclose information to:

1. courts and tribunals;
2. law-enforcement agencies;
3. tax authorities;
4. regulators;
5. statutory authorities; and
6. other governmental bodies,

where required by law, legal process, regulatory direction or a lawful request.

13.5Corporate Transactions

Personal data may be disclosed in connection with:

1. a merger;
2. acquisition;
3. investment;
4. restructuring;
5. transfer of business or assets;
6. insolvency proceeding; or
7. due diligence for a proposed corporate transaction.

Any recipient will be required to handle personal data consistently with applicable law.

13.6With Your Direction or Consent

We may share information with another person or entity where you expressly direct or authorise us to do so.

Where you request product comparison, matching or application routing, your information may be shared with one or more relevant providers.

Before sharing information beyond the provider directly selected by you, we may obtain an appropriate authorisation explaining:

1. the purpose of sharing;
2. the type of providers involved;
3. the categories of information to be shared; and
4. how you may withdraw or manage the authorisation.

Receiving or viewing an offer does not require you to accept it.

We primarily endeavour to process and store Platform data in India.

Some technology or service providers may process limited information from or through locations outside India where legally permitted.

Where personal data is transferred outside India, we will take reasonable steps to ensure that:

1. the transfer is legally permitted;
2. contractual and security protections are applied;
3. access is restricted to authorised purposes; and
4. any government restriction on transfer to a particular jurisdiction is observed.

Certain payment-system data may be stored or processed in accordance with applicable payment-system requirements.

We retain personal data only for as long as reasonably necessary for:

1. providing the requested service;
2. maintaining your account;
3. completing pending transactions;
4. servicing an application or product;
5. complying with legal and regulatory obligations;
6. maintaining audit and consent records;
7. preventing and investigating fraud;
8. resolving disputes and grievances;
9. enforcing agreements; and
10. establishing or defending legal claims.

Retention periods may differ according to the category of information and the relevant product.

After the applicable retention period, personal data may be:

1. securely deleted;
2. anonymised;
3. archived with restricted access; or
4. retained where continued retention is required by law, regulatory direction, legal proceedings or an enforceable contractual obligation.

Closing your account does not automatically require deletion of records that must lawfully be retained.

We maintain reasonable technical and organisational safeguards designed to protect personal data against:

1. unauthorised access;
2. accidental loss;
3. misuse;
4. alteration;
5. disclosure;
6. destruction; and
7. other security risks.

Safeguards may include:

1. encryption in transit and at rest, where appropriate;
2. access controls;
3. role-based permissions;
4. multi-factor authentication;
5. logging and monitoring;
6. network and application security controls;
7. vulnerability management;
8. secure software-development practices;
9. employee confidentiality obligations;
10. vendor-security assessments;
11. backup and recovery controls; and
12. incident-response procedures.

No electronic system is completely secure. You must protect your password, OTP and device and promptly inform us of suspected account compromise.

Where a personal-data breach occurs, we may:

1. investigate and contain the incident;
2. take remedial and preventive measures;
3. preserve relevant records;
4. notify affected individuals where required;
5. notify the competent authority or Data Protection Board where required; and
6. coordinate with relevant service providers, regulators and law-enforcement agencies.

Any notification may describe the nature of the incident, possible consequences, steps taken and actions you may take to protect yourself.

Subject to applicable law, you may have the right to:

1. obtain information about the personal data being processed;
2. request a summary of processing activities;
3. request correction of inaccurate or misleading personal data;
4. request completion of incomplete personal data;
5. request updating of outdated personal data;
6. request erasure of personal data that is no longer required, subject to lawful retention;
7. withdraw consent;
8. manage communication preferences;
9. raise a grievance;
10. nominate another individual to exercise rights in the event of death or incapacity; and
11. exercise any other right available under applicable law.

We may need to verify your identity before acting on a request.

A request may be declined or limited where retention or processing is necessary for legal compliance, fraud prevention, dispute resolution, enforcement of rights or another lawful purpose. Where appropriate, we will communicate the reason for such limitation.

You agree to:

1. provide accurate and authentic information;
2. update information when it changes;
3. not provide another person’s information without authority;
4. not impersonate another person;
5. protect your login credentials and OTPs;
6. review notices before providing consent;
7. promptly report suspected fraud or unauthorised account use; and
8. not submit frivolous, false or fraudulent requests or complaints.

We are not responsible for consequences arising from materially inaccurate or unauthorised information submitted by you.

You may withdraw consent through:

1. account or privacy settings, where available;
2. the method stated in the relevant consent notice;
3. the unsubscribe option in promotional communications; or
4. a written request to our privacy or grievance contact.

Withdrawal will apply prospectively.

Where personal data is necessary to provide an ongoing service, withdrawing consent may result in:

1. the relevant application being discontinued;
2. a feature becoming unavailable;
3. the inability to complete a transaction; or
4. account closure, subject to pending obligations and lawful retention.

Withdrawal will not cancel obligations already incurred under a loan, insurance policy, payment, voucher or other product agreement.

You may update certain profile information through your account.

For information that cannot be edited directly, you may submit a request to us. We may require supporting documentation before changing verified identity, financial or transaction information.

Erasure requests will be considered subject to:

1. legal and regulatory record-retention requirements;
2. pending applications or transactions;
3. outstanding payment or repayment obligations;
4. fraud-prevention needs;
5. ongoing complaints or disputes;
6. legal claims; and
7. contractual obligations to service providers.

For privacy-related questions, requests or grievances, contact:

Privacy or Grievance Officer: Mr. Ajay Tiwari
Designation: Customer Grievance Officer
Email: info@emeraldfin.com
Telephone: +91-172-4603859
Address: SCO 7, Industrial Area Phase 2, Chandigarh - 160002
Working Hours: 10 am to 6 pm

Your request should include:

1. your name;
2. registered mobile number or email address;
3. the nature of your request;
4. the relevant application or transaction reference, where applicable; and
5. supporting information reasonably necessary to verify and resolve the request.

We will acknowledge and address requests within the period required under applicable law.

If your grievance is not resolved through our internal process, you may use any escalation or complaint mechanism available under applicable law.

Where permitted by applicable law, you may nominate another individual to exercise your data-protection rights in the event of your death or incapacity.

The nomination process, verification requirements and scope of authority may be provided through the Platform or upon request.

Emerald Ekam is intended for persons who are at least 18 years old and legally competent to enter into contracts.

We do not knowingly offer financial products through the Platform directly to children.

Where we become aware that personal data of a child has been submitted without lawful authority, we may:

1. restrict or close the relevant account;
2. stop the related processing;
3. seek appropriate verification; and
4. delete the information unless retention is required by law.

The Platform may redirect you to or integrate with third-party websites, applications or services.

Third parties may independently collect personal data from you. Their collection and processing will be governed by their own privacy policies and terms.

We encourage you to review those policies before providing information.

Eclat is not responsible for the privacy practices of a third party acting independently of Eclat.

You may manage promotional communications by:

1. selecting the unsubscribe option in an email;
2. using an opt-out mechanism provided in a message;
3. changing available account preferences; or
4. contacting us.

We may retain limited information necessary to maintain your opt-out preference.

Even after opting out of marketing, you may receive:

1. OTPs;
2. security alerts;
3. transaction confirmations;
4. application updates;
5. payment or repayment reminders;
6. grievance communications; and
7. notices required by law or contract.

We may create aggregated or anonymised information that does not identify you.

Such information may be used for:

1. analytics;
2. research;
3. product development;
4. operational reporting;
5. fraud and risk analysis;
6. market analysis; and
7. improving services.

Where information has been properly anonymised and can no longer identify an individual, it may not constitute personal data under applicable law.

We may update this Privacy Policy to reflect changes in:

1. law or regulation;
2. products and services;
3. processing activities;
4. technology;
5. security practices; or
6. business operations.

The updated Privacy Policy will be published on the Platform with the revised “Last Updated” date.

Where a change materially affects the purpose of processing or requires fresh consent, we will provide an appropriate notice or obtain consent as required.

This Privacy Policy may be made available in English and other languages.

Where translations are provided, they are intended to improve accessibility. In the event of an inconsistency, the version identified by Eclat as the governing version will apply, subject to applicable law.

Eclat Net Advisors Private Limited
Emerald Ekam

Registered Office: SCO 7, Industrial Area Phase 2, Chandigarh - 160002
Email: info@emeraldfin.com
Customer Support Email: care@emeraldfin.com

By creating an account, submitting an application, completing a transaction or continuing to use Emerald Ekam, you acknowledge that you have read and understood this Privacy Policy.

Where your consent is required for a particular processing activity, such consent will be obtained separately and may be withdrawn in accordance with the applicable notice and law.